US 8082581 B2
A network device may manage communication sessions with clients so that attempts at the client to automatically keep the session alive can be ignored for purposes of timing out the session. The device may examine resource requests received from the client as uniform resource locators (URLs) and determine whether the URLs include a context variable. The device may determine whether to reset a timeout period for the communication session based on a presence of the context variable in the URL. At the client side, the context variable may be attached to URLs that are part of functions configured to automatically access the network device.
1. A device comprising:
an input/output mechanism to receive, from a downstream client device, a resource request for a remote resource, where the resource request includes context information that indicates whether the resource request is automatically generated by a periodically-called function; and
a processor to:
determine whether the context information indicates that the resource request was automatically generated by a periodically-called function, and
refrain, in response to determining that the resource request was automatically generated by a periodically-called function, from resetting a session timeout value associated with providing the remote resource to the client device.
2. The device of
3. The device of
4. The device of
5. The device of
6. The device of
7. The device of
8. A non-transient computer-readable medium to store instructions executable by a processor of a computer device, the instructions comprising:
an instruction to receive, from a client device, a resource request for a remote resource, where the resource request includes context information that indicates whether the resource request is automatically generated by a periodically-called function;
an instruction to determine, based on the context information, that the resource request was automatically generated by a periodically-called function; and
an instruction to refrain, in response to determining that the resource request was automatically generated by a periodically-called function, from resetting a session timeout value associated with providing the remote resource to the client device.
9. The non-transient computer-readable medium of
10. The non-transient computer-readable medium of
11. The non-transient computer-readable medium of
12. The non-transient computer-readable medium of
13. The non-transient computer-readable medium of
14. The non-transient computer-readable medium of
15. A method comprising:
receiving, by a computer device and from a client device, a resource request for a remote resource, where the resource request includes context information that includes an indication of a periodicity of the resource request; and
refraining from resetting, by the computer device and in response to determining that the resource request includes the context information that includes the indication of the periodicity of the resource request, a session timeout value associated with providing the remote resource to the client device.
16. The method of
17. The method of
18. The method of
19. The method of
20. The method of
This application is a continuation of U.S. patent application Ser. No. 11/166,778, filed Jun. 27, 2005, the disclosure of which is incorporated by reference herein.
1. Field of the Invention
Principles of the invention relate generally to network security and, more particularly, to managing session timeouts in a network device.
2. Description of Related Art
A corporation may protect its network in a number of different ways. For example, a corporate security infrastructure may include firewalls, intrusion detection, Uniform Resource Locator (URL) filtering, and content inspection. Further, corporations may enforce certain procedures that must be followed by employees who wish to use processing devices to access the corporate network from within the office.
Telecommuters, mobile employees, remote business partners, etc. may desire remote access to a corporate network. At least some of these users may wish to access the corporate network over the Internet or via another network or group of networks.
One class of secure remote access technology that is gaining in popularity is the so-called Secure Sockets Layer (SSL) Virtual Private Network (VPN) connection. SSL VPNs compete with IP Security Protocol (IPSec) VPNs and have a number of potential advantages over IPSec VPNs, including application access flexibility, high security, and overall simplicity.
SSL VPNs may be implemented through an SSL VPN gateway device, which makes client/server applications available to remote users (“clients”) through standard Internet browser software. The “back-end” server devices in a corporate network can securely connect with remote clients using security provided through an SSL connection, which is typically a standard feature in browsers. The SSL VPN gateway may operate in the application layer to communicate with the back-end servers and then transmit the information obtained from the back-end servers to the client's web browser. The back-end servers may be executing various corporate applications. The SSL VPN gateway may use built-in “screen scraping” protocols to split the emulation and display processing of the corporate applications so that only the applications' display is sent to the client browser. In this manner, corporate resources/applications can be made available to remote clients without requiring significant customization of the client computers.
One security policy that is frequently enforced in SSL VPN gateways is one that automatically logs users out after a predetermined time period of inactivity (a “timeout”). For instance, if a user walks away from a computer but forgets to log out, by timing out the client, the client will not be indefinitely connected to the protected corporate intranet. Accordingly, it is desirable to ensure that this type of automatic logout based on user inactivity is as accurate as possible in detecting when a user becomes inactive.
One aspect is directed to a method that includes receiving a resource request as part of a secure communication session with a client and determining whether the resource request includes a URL that includes a context variable. The method further includes determining whether to reset a timeout period for the communication session based on a presence of the context variable in the URL.
Another aspect is directed to a network device that includes a processor and a computer memory operatively coupled to the processor. The computer memory includes programming instructions configured to establish a session between the network device and a client device. The computer memory further includes programming instructions configured to examine a resource request received from the client device and instructions configured to reset a timeout period for the session between the network device and the client device based on whether the examined resource request includes a context. The context is inserted into the resource request independently of an initial implementation of the resource request.
Yet another aspect is directed to a computer-implemented method that includes scanning scripts present in hyper-text markup language (HTML) for functions that execute automatically. The method further includes examining the code executed by the functions to locate resource requests to a remote server. Further, the method includes attaching a context to the located resource requests, the context indicating the resource request was generated by a function configured to automatically access the remote server.
Yet another aspect is directed to a system that includes a security application installed on a client device and a gateway application. The security application is configured to attach context information to a resource request for a remote resource requested from a browser application when the resource request is automatically generated by a function. The gateway device is configured to determine whether to reset a session timeout value for the client device based on whether the context information is included in the resource request.
The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate an embodiment of the invention and, together with the description, explain the invention. In the drawings,
The following detailed description of the invention refers to the accompanying drawings. The same reference numbers in different drawings may identify the same or similar elements. Also, the following detailed description does not limit the invention.
As described herein, a network device implements an SSL VPN gateway for client devices. Context information is attached at the client to resource requests when the resource requests are generated automatically for the purpose of, for example, keeping a session alive. The context information can be used by the SSL VPN gateway to determine whether a session timeout period should be reset.
Client devices 108 and 110 may be processing devices, such as personal computers (PCs), laptop computers, personal digital assistants (PDAs), cell phones, or other types of devices that users use to connect to networks 102 and 104. Server 106 and gateway 120 may also include a processing device or multiple distributed processing devices.
For clarity, only two client devices 108 and 110, one gateway 120, and one server 106 are shown in
Clients 108 and 110 and may wish to connect to network 104 to access publicly available resources, such as web pages being served by public web servers. Clients 108 and 110 may also connect to proprietary resources stored on network 102, such as, in the situation when network 102 is a corporate network, proprietary corporate resources, such as corporate web pages, email applications, or other corporate data or corporate applications. These proprietary corporate resources may be hosted by processing device(s) such as server 106. Client device 110 may connect directly to server 106 over the secure proprietary network 102. Client 108, however, because it connects to proprietary network 102 via public network 104, may connect to server via gateway 120. Gateway 120 may generally assist in providing security functions for proprietary network 102.
Processor 220 may include one or more conventional processors or microprocessors that interpret and execute instructions. Memory 230 may be a random access memory (RAM) or another type of dynamic storage device that stores information and instructions for execution by processor 220. Memory 230 may also store temporary variables or other intermediate information used during execution of instructions by processor 220. ROM 240 may include a conventional ROM device or another type of static storage device that stores static information and instructions for processor 220. Storage device 250 may include any type of magnetic or optical recording medium and its corresponding drive, such as a magnetic disk or optical disk and its corresponding disk drive.
Input device 260 may include one or more mechanisms that permit a user to input information to system 200, such as a keyboard, a mouse, a pen, a biometric mechanism, such as a voice recognition device, etc. Output device 270 may include one or more mechanisms that output information to the user, including a display, a printer, etc. Communication interface 280 may include any transceiver-like mechanism that enables device 200 to communicate via a network. For example, communication interface 280 may include mechanisms for communicating with other networked devices and/or systems via wired, wireless or optical connections.
Device 200 may perform functions in response to processor 220 executing sequences of instructions contained in a computer-readable medium, such as memory 230. A computer-readable medium may include one or more memory devices and/or carrier waves. Such instructions may be read into memory 230 from another computer-readable medium, such as storage device 250, or from a separate device via communication interface 280.
Execution of the sequences of instructions contained in memory 230 may cause processor 220 to perform certain acts that will be described hereafter. In alternative implementations, hard-wired circuitry may be used in place of or in combination with software instructions to implement the present invention. Thus, the present invention is not limited to any specific combination of hardware circuitry and software.
Gateway 120 may, for example, authorize client devices wishing to access resources of proprietary network 102 and screen data passing between proprietary network 102 and public network 104. In one implementation, gateway 120 may assist client device 108 in connecting to proprietary network 102 using an SSL VPN.
Accordingly, by connecting to SSL VPN gateway 320 using a web browser, client device 308 can connect to proprietary network 102 by simply navigating to a predetermined Uniform Resource Locator (URL) of SSL VPN gateway 320. SSL VPN gateway 320 may use “screen scraping” protocols to split the emulation and display processing of the services/applications on back-end server 306 so that the application's display is sent to client device 308 as a graphic representation that can be displayed at browser 312. In some implementations, client device 308, upon first login at SSL VPN gateway 320, may download a security application 314 (e.g., a Java applet) that acts as a browser enhancement and that assists in communicating with SSL VPN gateway 320. In other implementations, security application 314 may be pre-configured on client device 308.
Security application 314 may assist communications with SSL VPN gateway 320 in a number of ways. For example, when the user of client device 308 first connects with proprietary network 102, security application 314 may download security checking code and/or data that may execute on client device 308 and check client device 308 for security breaches, such as the presence of viruses, trojans, or key-logging programs. Additionally, as will be described in more detail below, security application 314 may assist SSL VPN gateway 320 in handling session timeouts for the connection of client device 308 to SSL VPN gateway 320.
SSL VPN gateway 320 may keep track of a timeout period for each SSL session 315 that is established with SSL VPN gateway 320. The timeout period relates to how long session 315 will be kept open without any user interaction with back-end server 306. Whenever the user interacts with back-end server 306 in an approved manner, the current value of the timeout period may be reset to zero. Whether to implement a session timeout and the length of the timeout value may be configurable by an administrator of SSL VPN gateway 320. Implementing a timeout period for users can be important for network security because leaving a session open for an extended length of time even when the user is not actively using the session (and may no longer be at the client device) can expose back-end server 306 and/or the session to malicious users.
Either intentionally or unintentionally, the user of client device 308 may attempt to circumvent the timeout period by using browser-based scripts to automatically query back-end server 306 at a predetermined interval. Client device 308 and SSL VPN gateway 320, consistent with an aspect of the invention, may be configured to disable such attempts to circumvent the timeout period.
The functions identified in act 401 may be associated with a context (act 402). The context may be implemented by wrapping the function in a custom function that instantiates the context. The context may later be used to identify a request associated with the identified function to SSL VPN gateway 320. In one implementation, the context may be a variable that is named based on the name of the identified function and based on the time period associated with the function. For example, for a SetTimeout function in which the delay period is set to 50 seconds (50,000 milliseconds), the context variable may be “ContextVariableSetTimeout=50000”.
The functions identified in act 401 are associated with code that results in the evaluation of an expression or the execution of a function. The code may be examined by other custom functions and a determination made as to whether the code will affect back-end server 306 (acts 403 and 404). If it is determined that the code will affect back-end server 306, the context is attached to a URL associated with the code (act 405). As will be described in more detail below with reference to
The determination of whether the code will affect back-end server 306 (act 404) can be made using a number of different techniques. For example, methods in the code can compared to a list of predetermined methods that are known to be able to affect back-end server 306. Examples of such methods include the “document.open( )” method, where the argument for this method is a URL that is to be opened.
Script 610 is an example of script 601 after being rewritten to include custom functions in act 402. In this example, the custom functions are the functions named “DanaMethodOpen” and “DanaFuncSetTimeout.” DanaMethodOpen 611 is a custom function that serves as a wrapper for “document.open.” As its arguments, DanaMethodOpen 611 indicates that it is a wrapper for the document.open method and it includes the URL 602 that was included with the original document.open method. DanaFuncSetTimeout 612 is another custom function that serves as a wrapper for the function setTimeout. As its arguments, DataFuncSetTimeout 612 indicates that is a wrapper for the setTimeout function and includes the arguments included with the original setTimeout function.
In operation, when AutoEmailRequest is called by the client during normal execution, it will call DanaMethodOpen 611 and DanaFuncSetTimeout 612. The function DanaFuncSetTimeout 612, when called, may create a context variable that is associated with AutoEmailRequest. For example, the context variable created by DanaFuncSetTimeout 612 may be DataTimeoutCtx=60000. DataMethodOpen 611, when called, may check whether the context variable is set to a valid value. If so, it may attach the context variable to the URL and call the document.open method. In this example, the document.open method may be called with the URL “https://corporate.gateway.com/email/account?-userid=ed&DataTimeoutCtx=60000.”
In summary, in the example of
The custom function names and context variable names illustrated in
If no context variable is located, the request may be treated as valid user activity and the session timeout period for the user may be reset (acts 702 and 703). For example, if the session timeout period is set so that a client is automatically logged out after ten minutes, and there has currently been five minutes of no activity, the session timeout period may be reset so that there will be ten more minutes remaining until the client is automatically logged out.
On the other hand, when a context variable is located (act 702), the timeout period is not reset and the timeout period may continue to run (act 704). Additionally, the context variable may be removed from the URL (act 705).
SSL VPN gateway 320 may interpret the request and access an appropriate back-end server 306 to satisfy the request (act 706). For example, in the request shown in
SSL VPN gateway 320 may receive a response from the accessed back-end server 306 and forward the response to client device 308 (act 707). If needed, the response may be reformatted for client device 308, such as by reformatting information from a non-web application, such as a mail server, into a format that can be sent in HTML format to client device 308.
As described above, an SSL VPN gateway provides security and accessibility features of existing SSL VPN gateways and additionally includes the ability to intelligently determine when to treat user requests as genuine user requests that reset the session timeout period. With this feature, an SSL VPN gateway can enhance session security of a client.
It will be apparent to one of ordinary skill in the art that aspects of the invention, as described above, may be implemented in many different forms of software, firmware, and hardware in the implementations illustrated in the figures. The actual software code or specialized control hardware used to implement aspects consistent with the invention is not limiting of the invention. Thus, the operation and behavior of the aspects were described without reference to the specific software code or hardware design—it being understood that a person of ordinary skill in the art would be able to design software and control hardware to implement the aspects based on the description herein.
The foregoing description of embodiments of the invention provides illustration and description, but is not intended to be exhaustive or to limit the invention to the precise form disclosed. Modifications and variations are possible in light of the above teachings or may be acquired from practice of the invention. For example, although some of the operations described above were described in a particular order, the operations may be amenable to being performed simultaneously or in different orders to still achieve the same or equivalent results.
No element, act, or instruction used in the present application should be construed as critical or essential to the invention unless explicitly described as such. Also, as used herein, the article “a” is intended to potentially allow for one or more items. Further, the phrase “based on” is intended to mean “based, at least in part, on” unless explicitly stated otherwise.